Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Squid 2.5 can let attackers bypass access rules

CVE-2005-0194 · published 21 years ago
Summary

The 2.5 version of the Squid proxy server misreads empty permission lists in its configuration, including those that control user authentication. This mistake can let remote users get around the intended access controls if the admin overlooks warning messages. Review and correct the configuration file, removing any empty ACL entries, and upgrade to a newer Squid release that fixes the parsing issue.

What to do
  • Update debian squid to version 2.5.7-7.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian squid < 2.5.7-7
Fix: upgrade to 2.5.7-7
Debian:13 debian squid < 2.5.7-7
Fix: upgrade to 2.5.7-7
Debian:14 debian squid < 2.5.7-7
Fix: upgrade to 2.5.7-7
– squid squid 2.0.patch1
2.0.patch2
2.0.pre1
2.0.release
2.1.patch1
2.1.patch2
2.1.pre1
2.1.pre3
2.1.pre4
2.1.release
2.2.devel3
2.2.devel4
26 more version ranges
cpe:2.3:a:squid:squid:2.0.patch1:*:*:*:*:*:*:*
Original advisory text
Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxy_auth ACLs without defined auth schemes, in a way that effectively removes arguments, whi...
Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxy_auth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warnings.
References
Severity
10.0 Critical
Exploitation
5% chance of attack within 30 days
Timeline
Published2 May 2005
Updated30 Oct 2026
First seen8 Sep 2026
Sources
DEBIAN-CVE-2005-0194 · OSV
CVE-2005-0194 · NVD
Track software like this
Free during beta